2018 Latest CompTIA PenTest+ PT0-001 Practice Questions

1. A security analyst was provided with a detailed penetration report, which was performed against the organization’s DMZ environment. It was noted on the report that a finding has a CVSS base score of 100.

Which of the following levels of difficulty would be required to exploit this vulnerability?

Very difficult; perimeter systems are usually behind a firewall

Somewhat difficult, would require significant processing power to exploit

Trivial, little effort is required to exploit this finding

Impossible; external hosts are hardened to protect against attacks

2. A penetration tester has gained access to a marketing employee’s device. The penetration tester wants to ensure that if the access is discovered, control of the device can be regained.

Which of the actions should the penetration tester use to maintain persistence to the device? (Select TWO)

Place an entry in HKLM\Software Microsoft\CurrentVersion\Run to call au57d.ps1.

Place an entry in C:\windows\system32\drivers\etc\hosts for 12.17.20.10 badcomptia.com

Place a script in C:\users\%username\local\appdata\roaming\templau57d.ps1

Create a fake service in Windows called RTAudio to execute manually

Place an entry for RTAudio in HKLM\CurrentControlSet\Services\RTAudio.

Create a schedule task to call C:\wwindows\system32\drivers\etc\hosts

3. Which of the following tools is used to perform a credential brute force attack?

Hydra

John the Ripper

Hashcat

Peach

4. Which of the following situations would cause a penetration tester to communicate with a system owner/client during the course of a test? (Select Two)

The tester discovers personally identifiable data on the system.

The system shows evidence of prior unauthorized compromise

The system shows a lack of hardening throughout

The system becomes unavailable following an attempted exploit

The tester discovers a finding on an out-of-scope system

5. A penetration tester has performed a security assessment for a startup firm. The report lists a total of ten vulnerabilities, with five identified as critical. The client does not have the remediate to immediately remediate all vulnerabilities.

Under such circumstances which of the following would be the BEST suggestion for the client?

Apply easy compensating controls for critical vulnerabilities to minimize the risk, and then reprioritize remediation

Identify the issues that can be remediated most quickly and address them first.

Implement the least impactful of the critical vulnerabilities’ remediations first, and then address other critical vulnerabilities

Fix the most critical vulnerability first, even if it means fixing the other vulnerabilities may take a very long time.

6. Which of the following is the reason why a penetration tester would run the chkconfig –del servicename command at the end of an engagement?

To remove the persistence

To enable persistence

To report persistence

To check for persistence

7. A penetration tester wants to target NETBIOS name service.

Which of the following is the MOST likely command to exploit the NETBIOS name service?

arpspoof

nmap

responder

burpsuite

8. A security consultant receives a document outlining the scope of an upcoming penetration test. This document contains IP addresses and times that each can be scanned.

Which of the following would contain this information?

Rules of engagement

Request for proposal

Master service agreement

Business impact analysis

9. A penetration tester reviews the scan results of a web application.

Which of the following vulnerabilities is MOST critical and should be prioritized for exploitation?

Stored XSS

Full path disclosure

Expired certificate

Clickjacking

10. A penetration tester observes that several high-numbered ports are listening on a public web server. However, the system owner says the application only uses port 443.

Which of the following would be BEST to recommend?

Transition the application to another port

Filter port 443 to specific IP addresses

Implement a web application firewall

Disable unneeded services

CompTIA PenTest+ PT0-001 Practice Questions

Leave a Reply Cancel reply